https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-63828.htmlhttps://patchthecve.com/cve/CVE-2025-63828.htmlWed, 17 Jun 2026 09:53:30 +0000MEDIUM 6.1: Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.https://patchthecve.com/cve/CVE-2025-44141.htmlhttps://patchthecve.com/cve/CVE-2025-44141.htmlSun, 05 Jul 2026 01:21:40 +0000MEDIUM 6.1: A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.https://patchthecve.com/cve/CVE-2025-25063.htmlhttps://patchthecve.com/cve/CVE-2025-25063.htmlWed, 17 Jun 2026 09:00:13 +0000MEDIUM 4.4: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, it https://patchthecve.com/cve/CVE-2025-25062.htmlhttps://patchthecve.com/cve/CVE-2025-25062.htmlWed, 17 Jun 2026 09:00:13 +0000MEDIUM 4.4: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrahttps://patchthecve.com/cve/CVE-2024-54123.htmlhttps://patchthecve.com/cve/CVE-2024-54123.htmlWed, 17 Jun 2026 08:09:48 +0000MEDIUM 6.1: Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.